Most sites with mod_security block a ridiculous list of words. I remember a few years back there was an animal lovers’ board where they were complaining about 403 errors every time they posted the word “cat”.
That is correct. If you have permission to send PMs to groups, you can send them to any group which is marked that PMs can be sent to it. For the most part, you only want to allow PMs to groups that it is appropriate to send to as a group.
Make your group a “hidden” group, then only its members can see it.
On second thought, I don’t think that would work. I do not think you can send PMs to hidden groups.
Probably you just want to turn off the user permission which allows sending PMs to groups for your regular users.